Refactor Provider Credentials

[grolu]

This PR refactors the backend /cloudprovidersecrets API

• Removed old endpoint that returned custom dashboard secret resource
• Added new /cloudprovidercredentials endpoint that returns list of credentials (sets) that contain related SecretBinding, Secret (if own) and resolved Quota resources
• Renamed secret store to credential store

This PR is also a preparation to support new CredentialsBinding resource

• Started renaming secret to credential (store)
• Work with SecretBinding as the leading resource, access referenced secret only when we need to access the actual secret data
• In a follow-up PR we can then also read CredentialsBindings in the backend and return with the list. The dashboard can then work with CredentialsBindings and SecretBindings in the frontend as they are more or less interchangeable. Only the reference to the Secret / WorkloadIdentity data is different so we need to add some kind of abstraction / transformation there.

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:
Tests need to be adapted

Release note:

[holgerkoser]

data is not optional

[holgerkoser]

I do not see anything that is dialog related. The api of this composable is very strange. LEt's talk about it.

[holgerkoser]

Add a test for this store. As template for the tests you can use:

//
// SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Gardener contributors
//
// SPDX-License-Identifier: Apache-2.0
//

import {
  setActivePinia,
  createPinia,
} from 'pinia'

import { useAppStore } from '@/store/app'
import { useAuthzStore } from '@/store/authz'
import { useCloudProfileStore } from '@/store/cloudProfile'
import { useCredentialStore } from '@/store/credential'
import { useGardenerExtensionStore } from '@/store/gardenerExtension'

import { useApi } from '@/composables/useApi'

const quotas = [{
  metadata: {
    name: 'project-quota',
    namespace: 'garden-trial',
  },
  spec: {
    scope: {
      kind: 'Project',
      apiVersion: 'core.gardener.cloud/v1beta1',
    },
    clusterLifetimeDays: 7,
  },
}]

const secretBindings = [{
  metadata: {
    name: 'aws-trial-secretbinding',
    namespace: 'garden-test',
  },
  provider: {
    type: 'aws',
  },
  quotas: [{
    name: 'project-quota',
    namespace: 'garden-trial',
  }],
  secretRef: {
    name: 'aws-secret',
    namespace: 'garden-trial',
  },
}]

const secrets = [{
  metadata: {
    name: 'aws-secret',
    namespace: 'garden-trial',
  },
  data: {
    accessKeyID: 'id',
    secretAccessKey: 'supersecret',
  },
}]

describe('stores', () => {
  describe('credential', () => {
    const namespace = 'default'

    let api
    let appStore
    let authzStore
    let cloudProfileStore
    let gardenerExtensionStore
    let credentialStore

    beforeEach(async () => {
      setActivePinia(createPinia())
      api = useApi()
      vi.spyOn(api, 'getCloudProviderCredentials')
      vi.spyOn(api, 'createCloudProviderCredential')
      vi.spyOn(api, 'updateCloudProviderCredential')
      vi.spyOn(api, 'deleteCloudProviderCredential')
      appStore = useAppStore()
      vi.spyOn(appStore, 'setSuccess')
      authzStore = useAuthzStore()
      authzStore.setNamespace(namespace)
      cloudProfileStore = useCloudProfileStore()
      cloudProfileStore.list = [
        {
          metadata: {
            providerType: 'aws',
          },
        },
        {
          metadata: {
            providerType: 'azure',
          },
        },
        {
          metadata: {
            providerType: 'gcp',
          },
        },
      ]
      gardenerExtensionStore = useGardenerExtensionStore()
      gardenerExtensionStore.list = [{
        resources: [
          {
            kind: 'DNSRecord',
            type: 'aws-route53',
            primary: true,
          },
        ],
      }]
      credentialStore = useCredentialStore()
      credentialStore.cloudProviderCredentials = {
        quotas: [
          ...quotas,
        ],
        secrets: [
          ...fixtures.credentials.secrets,
          ...secrets,
        ],
        secretBindings: [
          ...fixtures.credentials.secretBindings,
          ...secretBindings,
        ],
      }
    })

    afterEach(() => {
      appStore.setSuccess.mockClear()
      api.getCloudProviderCredentials.mockClear()
      api.createCloudProviderCredential.mockClear()
      api.updateCloudProviderCredential.mockClear()
      api.deleteCloudProviderCredential.mockClear()
    })

    it('should create a new credential store', () => {
      expect(credentialStore.isInitial).toBe(false)
      expect(cloudProfileStore.sortedProviderTypeList).toEqual(['aws', 'azure', 'gcp'])
    })
  })
})

[holgerkoser]

I think this method is sufficient

[gitguardian]

⚠️ GitGuardian has uncovered 3 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
14824536	Triggered	Generic High Entropy Secret	c792b6f	frontend/fixtures/credentials.js	View secret
14824537	Triggered	Generic High Entropy Secret	c792b6f	frontend/tests/stores/credential.spec.js	View secret
14824538	Triggered	Generic High Entropy Secret	c792b6f	frontend/tests/stores/credential.spec.js	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}